source: trunk/src/sh_prelude.c@ 184

Last change on this file since 184 was 181, checked in by katerina, 16 years ago

Remove support for obsolete version 0.8 of libprelude (ticket #120).
File size: 39.2 KB
Line 
1/*
2 *
3 * Copyright (C) 2005 Yoann Vandoorselaere, Prelude IDS Technologies
4 * Rainer Wichmann
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2, or (at your option)
9 * any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; see the file COPYING. If not, write to
18 * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
19 *
20 */
21
22/*
23 * 28/04/2005 : R.W.:
24 * move libprelude 0.8 code to seperate file
25 *
26 * 23/04/2005 : R.W.:
27 * include libprelude 0.9 code from Yoann Vandoorselaere
28 */
29
30
31/*
32 * for strptime()
33 */
34#define _GNU_SOURCE 1
35
36#include "config_xor.h"
37
38#include <stdio.h>
39#include <string.h>
40#include <sys/types.h>
41
42#if TIME_WITH_SYS_TIME
43
44# include <sys/time.h>
45# include <time.h>
46
47#else
48
49# if HAVE_SYS_TIME_H
50# include <sys/time.h>
51# else
52# include <time.h>
53# endif
54
55#endif
56
57#include <unistd.h>
58#include <syslog.h>
59#include <pwd.h>
60
61int sh_argc_store;
62char ** sh_argv_store;
63
64#if defined(HAVE_LIBPRELUDE)
65
66
67/*
68 * _() macros are samhain specific; they are used to replace string
69 * constants at runtime. This is part of the samhain stealth mode
70 * (fill string constants with encoded strings, decode at runtime).
71 */
72#define FIL__ _("sh_prelude.c")
73
74
75#include <libprelude/idmef.h>
76#include <libprelude/prelude.h>
77
78/*
79 * includes for samhain-specific functions (sl_strstr, sh_error_handle)
80 */
81#include "samhain.h"
82#include "sh_cat.h"
83#include "sh_error_min.h"
84#include "sh_prelude.h"
85#define SH_NEED_PWD_GRP 1
86#include "sh_static.h"
87char * sh_util_strdup (const char * str) SH_GNUC_MALLOC;
88/*
89 * When SH_USE_XML is set, value are formated using name="value".
90 * Otherwise, value is formatted using the format name=<value>.
91 */
92#ifdef SH_USE_XML
93# define VALUE_DELIM_START '"'
94# define VALUE_DELIM_END '"'
95#else
96# define VALUE_DELIM_START '<'
97# define VALUE_DELIM_END '>'
98#endif
99
100#define IDMEF_ANALYZER_MODEL _("Samhain")
101#define IDMEF_ANALYZER_CLASS _("Integrity Checker")
102#define IDMEF_ANALYZER_VERSION VERSION
103#define IDMEF_ANALYZER_MANUFACTURER _("http://www.la-samhna.de/samhain/")
104
105
106
107/*
108 * 0 = not initialized; -1 = failed; 1 = initialized
109 */
110static int initialized = 0;
111static int ready_for_init = 0;
112
113static char *profile = NULL;
114static prelude_client_t *client = NULL;
115
116static int severity_map[1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH] = {
117 /* 0: unused (?) */ 0,
118 /* 1: INFO */ 0,
119 /* 2: LOW */ SH_ERR_ALL|SH_ERR_INFO,
120 /* 3: MEDIUM */ SH_ERR_NOTICE|SH_ERR_WARN|SH_ERR_STAMP|SH_ERR_ERR,
121 /* 4: HIGH */ SH_ERR_SEVERE|SH_ERR_FATAL
122};
123
124/* returns 0/tiger, 1/sha1, or 2/md5
125 */
126extern int sh_tiger_get_hashtype(void);
127
128static void clear_and_set (int setpos, int flag)
129{
130 unsigned int i;
131 /* clear everywhere, and set at correct position */
132 for (i = 1; i < (1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH); ++i)
133 severity_map[i] &= ~flag;
134 severity_map[setpos] |= flag;
135 return;
136}
137
138static int set_prelude_severity_int (const char * str, int prelude_sev)
139{
140 char * p;
141 char * dup = strdup (str);
142#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
143 char * saveptr;
144#endif
145
146 if (!dup)
147 return -1;
148
149#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
150 p = strtok_r (dup, ", \t", &saveptr);
151#else
152 p = strtok (dup, ", \t");
153#endif
154 if (p) {
155 do {
156 if (0 == strcmp (p, _("alert")))
157 clear_and_set (prelude_sev, SH_ERR_FATAL);
158 else if (0 == strcmp (p, _("crit")))
159 clear_and_set (prelude_sev, SH_ERR_SEVERE);
160 else if (0 == strcmp (p, _("err")))
161 clear_and_set (prelude_sev, SH_ERR_ERR);
162 else if (0 == strcmp (p, _("mark")))
163 clear_and_set (prelude_sev, SH_ERR_STAMP);
164 else if (0 == strcmp (p, _("warn")))
165 clear_and_set (prelude_sev, SH_ERR_WARN);
166 else if (0 == strcmp (p, _("notice")))
167 clear_and_set (prelude_sev, SH_ERR_NOTICE);
168 else if (0 == strcmp (p, _("debug")))
169 clear_and_set (prelude_sev, SH_ERR_ALL);
170 else if (0 == strcmp (p, _("info")))
171 clear_and_set (prelude_sev, SH_ERR_INFO);
172 else {
173 free (dup);
174 return -1;
175 }
176#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
177 p = strtok_r (NULL, ", \t", &saveptr);
178#else
179 p = strtok (NULL, ", \t");
180#endif
181 } while (p);
182 }
183 free(dup);
184 return 0;
185}
186
187int sh_prelude_map_info (const char * str)
188{
189 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
190}
191int sh_prelude_map_low (const char * str)
192{
193 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
194}
195int sh_prelude_map_medium (const char * str)
196{
197 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
198}
199int sh_prelude_map_high (const char * str)
200{
201 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
202}
203
204static idmef_impact_severity_t map_severity (int sam_sev)
205{
206 int i;
207 int max = 1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH;
208 idmef_impact_severity_t retval = IDMEF_IMPACT_SEVERITY_MEDIUM;
209
210 for (i = 0; i < max; ++i) {
211 if (severity_map[i] & sam_sev) {
212 retval = (idmef_impact_severity_t) i;
213 }
214 }
215 return retval;
216}
217
218static char *do_get_value(char *ptr, char delim_start, char delim_end)
219{
220 char *ret = NULL;
221
222 ptr = strchr(ptr, delim_start);
223 if ( ! ptr )
224 return NULL;
225
226 ret = ++ptr;
227
228 ptr = strchr(ptr, delim_end);
229 if ( ! ptr )
230 return NULL;
231
232 *ptr = '\0';
233 ret = strdup(ret);
234 *ptr = delim_end;
235
236 return ret;
237}
238
239
240
241static char *get_value(char *msg, const char *toktmp, const char *toksuffix)
242{
243 char *ptr, tok[128];
244
245 snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
246
247 ptr = strstr(msg, tok);
248 if ( ! ptr )
249 return NULL;
250
251 return do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
252}
253
254
255
256static char *get_time_value(char *msg, const char *toktmp, const char *toksuffix)
257{
258
259 char *ret, *ptr, tok[128];
260
261 snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
262
263 ptr = strstr(msg, tok);
264 if ( ! ptr )
265 return NULL;
266
267#ifndef SH_USE_XML
268 ret = do_get_value(ptr, '[', ']');
269#else
270 ret = do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
271#endif
272
273 return ret;
274}
275
276
277
278
279#if 0
280void debug_print_message(idmef_message_t *msg)
281{
282 int ret;
283 prelude_io_t *fd;
284
285 ret = prelude_io_new(&fd);
286 if ( ret < 0 )
287 return;
288
289 prelude_io_set_file_io(fd, stderr);
290 idmef_message_print(idmef, fd);
291
292 prelude_io_destroy(fd);
293}
294#endif
295
296
297
298static int idmef_time_from_samhain(idmef_time_t **time, const char *str)
299{
300 int ret;
301 char *ptr;
302 time_t utc;
303 struct tm lt;
304
305 /*
306 * Samhain stamp are encoded in UTC.
307 */
308 ptr = strptime(str, _("%Y-%m-%dT%H:%M:%S"), &lt);
309 if ( ! ptr ) {
310 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
311 _("could not format Samhain time"), _("idmef_time_from_samhain"));
312 return -1;
313 }
314
315 utc = prelude_timegm(&lt);
316
317 ret = idmef_time_new_from_time(time, &utc);
318 if ( ret < 0 )
319 return ret;
320
321 return 0;
322}
323
324/* flawfinder: ignore *//* is part of name, not access() */
325static void get_access_info(idmef_file_access_t *access, char * mode, int pos, int mpos)
326{
327 int got = 0;
328 int ret;
329 prelude_string_t *str;
330
331 do {
332 if ( mode[pos] == 'r' ) {
333 /* flawfinder: ignore *//* is part of name, not access() */
334 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
335 if ( ret < 0 )
336 return;
337 prelude_string_set_dup(str, _("read"));
338 ++got;
339 }
340 else if ( mode[pos] == 'w' ) {
341 /* flawfinder: ignore *//* is part of name, not access() */
342 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
343 if ( ret < 0 )
344 return;
345 prelude_string_set_dup(str, _("write"));
346 ++got;
347 }
348 else if ( mode[pos] == 'x' || mode[pos] == 's' || mode[pos] == 't') {
349 /* flawfinder: ignore *//* is part of name, not access() */
350 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
351 if ( ret < 0 )
352 return;
353
354 if ( mode[pos] == 'x' && mode[0] == 'd' )
355 prelude_string_set_dup(str, _("search"));
356
357 else if ( mode[pos] == 'x' || mode[pos] == 't' )
358 prelude_string_set_dup(str, _("execute"));
359
360 else /* 's' */
361 prelude_string_set_dup(str, _("executeAs"));
362 ++got;
363 }
364 ++pos;
365 } while (pos <= mpos);
366
367 if ( got == 0 ) {
368 /* flawfinder: ignore *//* is part of name, not access() */
369 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
370 if ( ret < 0 )
371 return;
372 prelude_string_set_dup(str, _("noAccess"));
373 }
374 return;
375}
376
377
378static void get_file_infos(idmef_target_t *target, char *msg,
379 idmef_file_category_t category)
380{
381 int ret;
382 int hashtype = 0;
383 char *ptr;
384 idmef_time_t *time;
385 idmef_file_t *file;
386 idmef_inode_t *inode;
387 prelude_string_t *str;
388 idmef_checksum_t *checksum;
389 idmef_file_access_t *access; /* flawfinder: ignore */
390 idmef_user_id_t *userid;
391 const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
392 char *mode = NULL;
393
394 ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
395 if ( ret < 0 )
396 return;
397 idmef_file_set_category(file, category);
398
399 ptr = get_value(msg, _("path"), NULL);
400 if ( ptr ) {
401 /*
402 * In term of IDMEF, this is the full path,
403 * including the name.
404 */
405 ret = idmef_file_new_path(file, &str);
406 if ( ret < 0 ) {
407 free(ptr);
408 return;
409 }
410 prelude_string_set_nodup(str, ptr);
411
412 ptr = strrchr(ptr, '/');
413 if ( ptr ) {
414 ret = idmef_file_new_name(file, &str);
415 if ( ret == 0 ) {
416 prelude_string_set_dup(str, ptr + 1);
417 }
418 }
419 }
420
421 ptr = get_value(msg, _("size"), suffix);
422 if ( ptr ) {
423 idmef_file_set_data_size(file, strtoul(ptr, NULL, 10));
424 free(ptr);
425 }
426
427 ptr = get_time_value(msg, _("mtime"), suffix);
428 if ( ptr ) {
429 ret = idmef_time_from_samhain(&time, ptr);
430 if ( ret == 0 ) {
431 idmef_file_set_modify_time(file, time);
432 }
433 free(ptr);
434 }
435
436 ptr = get_time_value(msg, _("ctime"), suffix);
437 if ( ptr ) {
438 ret = idmef_time_from_samhain(&time, ptr);
439 if ( ret == 0 ) {
440 idmef_file_set_create_time(file, time);
441 }
442 free(ptr);
443 }
444
445 ptr = get_value(msg, _("inode"), suffix);
446 if ( ptr ) {
447 ret = idmef_file_new_inode(file, &inode);
448 if ( ret == 0 ) {
449 char * dev = get_value(msg, _("dev"), suffix);
450 if (dev) {
451 char * q = strchr(dev, ',');
452 if (*q) {
453 *q = '\0'; ++q;
454 idmef_inode_set_major_device(inode, strtoul(dev, NULL, 0));
455 idmef_inode_set_minor_device(inode, strtoul( q, NULL, 0));
456 }
457 free(dev);
458 }
459 idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
460 }
461 free(ptr);
462 }
463
464 ptr = get_value(msg, _("chksum"), suffix);
465 if ( ptr ) {
466 ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
467 if ( ret < 0 ) {
468 free(ptr);
469 goto get_mode;
470 }
471
472 hashtype = sh_tiger_get_hashtype();
473
474 if (hashtype == 0)
475 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
476
477 else if (hashtype == 1)
478 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
479
480 else if (hashtype == 2)
481 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
482
483 else
484 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
485
486
487 ret = idmef_checksum_new_value(checksum, &str);
488 if ( ret < 0 ) {
489 free(ptr);
490 goto get_mode;
491 }
492
493 /* will be freed on destroy()
494 */
495 prelude_string_set_nodup(str, ptr);
496 }
497
498 get_mode:
499
500 mode = get_value(msg, _("mode"), suffix);
501 if ( mode ) {
502 /* flawfinder: ignore *//* is part of name, not access() */
503 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
504 if ( ret < 0 )
505 goto get_owner;
506
507 /* flawfinder: ignore *//* is part of name, not access() */
508 ret = idmef_file_access_new_user_id(access, &userid);
509 if ( ret < 0 )
510 goto get_owner;
511 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
512
513 /* flawfinder: ignore *//* is part of name, not access() */
514 get_access_info ( access, mode, 7, 9 );
515 }
516
517 get_owner:
518
519 ptr = get_value(msg, _("owner"), suffix);
520 if ( ptr ) {
521 char * uid;
522
523 /* flawfinder: ignore *//* is part of name, not access() */
524 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
525 if ( ret < 0 ) {
526 free(ptr);
527 goto get_group;
528 }
529
530 /* flawfinder: ignore *//* is part of name, not access() */
531 ret = idmef_file_access_new_user_id(access, &userid);
532 if ( ret < 0 ) {
533 free(ptr);
534 goto get_group;
535 }
536 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
537
538 ret = idmef_user_id_new_name(userid, &str);
539 if ( ret < 0 ) {
540 free(ptr);
541 goto get_group;
542 }
543 prelude_string_set_nodup(str, ptr);
544
545 uid = get_value(msg, _("iowner"), suffix);
546 if ( ! uid )
547 goto get_group;
548
549 idmef_user_id_set_number(userid, strtoul(uid, NULL, 0));
550
551 if ( mode ) {
552 /* flawfinder: ignore *//* is part of name, not access() */
553 get_access_info ( access, mode, 1, 3 );
554 }
555
556 free(uid);
557 }
558
559 get_group:
560
561 ptr = get_value(msg, _("group"), suffix);
562 if ( ptr ) {
563 char *gid;
564
565 /* flawfinder: ignore *//* is part of name, not access() */
566 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
567 if ( ret < 0 ) {
568 free(ptr);
569 goto mode_free;
570 }
571
572 ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore *//* is part of name, not access() */
573 if ( ret < 0 ) {
574 free(ptr);
575 goto mode_free;
576 }
577
578 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
579
580 ret = idmef_user_id_new_name(userid, &str);
581 if ( ret < 0 ) {
582 free(ptr);
583 goto mode_free;
584 }
585
586 prelude_string_set_nodup(str, ptr);
587
588 gid = get_value(msg, _("igroup"), suffix);
589 if ( ! gid )
590 goto mode_free;
591
592 idmef_user_id_set_number(userid, strtoul(gid, NULL, 0));
593
594 if ( mode ) {
595 get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
596 }
597
598 free(gid);
599 }
600
601 mode_free:
602
603 if ( mode ) {
604 free ( mode );
605 }
606
607 return;
608}
609
610
611
612static int map_policy_to_class(char *msg, unsigned long msgid, idmef_impact_t *impact, prelude_string_t *out)
613{
614 char *ptr;
615 int ret, i;
616 struct tbl {
617 unsigned int msgid;
618 const char *name;
619 idmef_impact_type_t type;
620 } tbl[] = {
621
622#ifdef SH_USE_UTMP
623 { MSG_UT_LG1X, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
624 { MSG_UT_LG1A, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
625 { MSG_UT_LG1B, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
626 { MSG_UT_LG2X, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
627 { MSG_UT_LG2A, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
628 { MSG_UT_LG2B, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
629 { MSG_UT_LG3X, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
630 { MSG_UT_LG3A, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
631 { MSG_UT_LG3B, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
632 { MSG_UT_LG3C, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
633#endif
634
635#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
636 { MSG_FI_MISS, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
637 { MSG_FI_MISS2, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
638 { MSG_FI_ADD, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
639 { MSG_FI_ADD2, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
640 { MSG_FI_CHAN, N_("File Modified"), IDMEF_IMPACT_TYPE_FILE },
641 { MSG_FI_NODIR, N_("File found where directory was expected"), IDMEF_IMPACT_TYPE_FILE },
642#endif
643
644#ifdef SH_USE_KERN
645 { MSG_KERN_POLICY, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
646 { MSG_KERN_POL_CO, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
647 { MSG_KERN_PROC, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
648 { MSG_KERN_GATE, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
649 { MSG_KERN_IDT, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
650 { MSG_KERN_SYSCALL, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
651#endif
652
653#ifdef SH_USE_PORTCHECK
654 { MSG_PORT_MISS, N_("Service closed"), IDMEF_IMPACT_TYPE_OTHER },
655 { MSG_PORT_NEW, N_("Service opened"), IDMEF_IMPACT_TYPE_OTHER },
656 { MSG_PORT_RESTART, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
657 { MSG_PORT_NEWPORT, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
658#endif
659
660#ifdef SH_USE_SUIDCHK
661 { MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
662#endif
663 /*
664 * This must be the last table entry
665 */
666 { 0, NULL, IDMEF_IMPACT_TYPE_OTHER },
667 };
668
669 for ( i = 0; tbl[i].name != NULL; i++ ) {
670 if ( tbl[i].msgid != msgid )
671 continue;
672
673 idmef_impact_set_type(impact, tbl[i].type);
674 return prelude_string_cat(out, _(tbl[i].name));
675 }
676
677 /* some other message
678 */
679 ptr = get_value(msg, _("msg"), NULL);
680 if ( ! ptr ) {
681 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
682 _("could not format Samhain message"), _("map_policy_to_class"));
683 return -1;
684 }
685
686 ret = prelude_string_cat(out, ptr);
687 free(ptr);
688
689 return ret;
690}
691
692
693#ifdef SH_USE_PORTCHECK
694static int get_service_info(char *msg, idmef_alert_t *alert)
695{
696 int ret;
697 long port;
698 char *ptr, *new, *tmp, *ip, *srv, *end;
699 prelude_string_t *str;
700 idmef_address_t *address;
701 idmef_node_t *node;
702 idmef_user_t *user;
703 idmef_process_t *process;
704 idmef_service_t *service;
705 idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
706
707 new = sh_util_strdup(msg);
708
709 ptr = strstr(new, _("port: "));
710 if ( ! ptr ) {
711 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
712 _("malformed Samhain port check message"), _("get_service_info"));
713 SH_FREE( new );
714 return -1;
715 }
716
717 ptr += 6; /* skip 'port: ', position on first byte of interface */
718 tmp = strchr(ptr, ':');
719 if ( ! tmp ) {
720 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
721 _("malformed Samhain port check message (no port)"), _("get_service_info"));
722 SH_FREE( new );
723 return -1;
724 }
725 *tmp = '\0';
726
727 /* Get interface
728 */
729 ip = strdup(ptr);
730 if ( ip ) {
731 if ( ! source ) {
732 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
733 if ( ret < 0 ) {
734 free(ip);
735 SH_FREE( new );
736 return ret;
737 }
738 }
739
740 ret = idmef_source_new_node(source, &node);
741 if ( ret < 0 ) {
742 free(ip);
743 SH_FREE( new );
744 return ret;
745 }
746
747 ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
748 if ( ret < 0 ) {
749 free(ip);
750 SH_FREE( new );
751 return ret;
752 }
753
754 ret = idmef_address_new_address(address, &str);
755 if ( ret < 0 ) {
756 free(ip);
757 SH_FREE( new );
758 return ret;
759 }
760
761 prelude_string_set_nodup(str, ip);
762 }
763
764 ptr = tmp;
765 ++ptr;
766 tmp = strchr(ptr, '/');
767 if ( ! tmp ) {
768 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
769 _("malformed Samhain port check message (no protocol)"), _("get_service_info"));
770 SH_FREE( new );
771 return -1;
772 }
773 *tmp = '\0';
774
775 /* Get port number
776 */
777 port = strtol(ptr, &end, 0);
778 if ( *ptr && *end == '\0' && port >= 0 && port < 65536) {
779
780 if ( ! source ) {
781 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
782 if ( ret < 0 ) {
783 free(srv);
784 SH_FREE( new );
785 return ret;
786 }
787 }
788
789 ret = idmef_source_new_service(source, &service);
790 if ( ret < 0 ) {
791 free(srv);
792 SH_FREE( new );
793 return ret;
794 }
795
796 idmef_service_set_port(service, port);
797 }
798
799 ptr = tmp;
800 ++ptr;
801 ptr = strchr(ptr, '(');
802 if ( ! ptr ) {
803 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
804 _("malformed Samhain port check message (no service)"), _("get_service_info"));
805 SH_FREE( new );
806 return -1;
807 }
808 ++ptr;
809 tmp = strchr(ptr, ')');
810 if ( ! tmp ) {
811 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
812 _("malformed Samhain port check message (service not closed)"), _("get_service_info"));
813 SH_FREE( new );
814 return -1;
815 }
816 *tmp = '\0';
817
818 /* Get service
819 */
820 srv = strdup(ptr);
821 if ( srv ) {
822 if ( ! source ) {
823 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
824 if ( ret < 0 ) {
825 free(srv);
826 SH_FREE( new );
827 return ret;
828 }
829 }
830
831 if ( ! service ) {
832 ret = idmef_source_new_service(source, &service);
833 if ( ret < 0 ) {
834 free(srv);
835 SH_FREE( new );
836 return ret;
837 }
838 }
839
840 ret = idmef_service_new_name(service, &str);
841 if ( ret < 0 ) {
842 free(srv);
843 SH_FREE( new );
844 return ret;
845 }
846
847 prelude_string_set_nodup(str, srv);
848 }
849
850 SH_FREE( new );
851
852 ptr = get_value(msg, _("user"), NULL);
853
854 if ( ptr ) {
855
856 ret = idmef_source_new_user(source, &user);
857 if ( ret < 0 ) {
858 free(ptr);
859 return ret;
860 }
861
862 ret = idmef_user_new_ident(user, &str);
863 if ( ret < 0 ) {
864 free(ptr);
865 return ret;
866 }
867 prelude_string_set_nodup(str, ptr);
868 }
869
870 ptr = get_value(msg, _("path"), NULL);
871
872 if ( ptr ) {
873
874 /*
875 * In term of IDMEF, this is the full path,
876 * including the name.
877 */
878 ret = idmef_source_new_process(source, &process);
879 if ( ret < 0 ) {
880 free(ptr);
881 return ret;
882 }
883
884 ret = idmef_process_new_path(process, &str);
885 if ( ret < 0 ) {
886 free(ptr);
887 return ret;
888 }
889 prelude_string_set_nodup(str, ptr);
890
891 ptr = strrchr(ptr, '/');
892 if ( ptr ) {
893 ret = idmef_process_new_name(process, &str);
894 if ( ret == 0 ) {
895 prelude_string_set_dup(str, ptr + 1);
896 }
897 }
898 }
899
900 return 0;
901}
902#endif
903
904static int get_login_info(char *msg, idmef_alert_t *alert)
905{
906 int ret;
907 char *ptr, *ip;
908 idmef_user_t *user;
909 idmef_node_t *node;
910 struct passwd *pw;
911#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
912 struct passwd pwd;
913 char buffer[SH_PWBUF_SIZE];
914#endif
915 prelude_string_t *str;
916 idmef_user_id_t *user_id;
917 idmef_address_t *address;
918 idmef_target_t *target = idmef_alert_get_next_target(alert, NULL);
919 idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
920
921 ip = ptr = get_value(msg, _("ip"), NULL);
922 if ( ptr ) {
923 if ( ! source ) {
924 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
925 if ( ret < 0 ) {
926 free(ptr);
927 return ret;
928 }
929 }
930
931 ret = idmef_source_new_node(source, &node);
932 if ( ret < 0 ) {
933 free(ptr);
934 return ret;
935 }
936
937 ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
938 if ( ret < 0 ) {
939 free(ptr);
940 return ret;
941 }
942
943 ret = idmef_address_new_address(address, &str);
944 if ( ret < 0 ) {
945 free(ptr);
946 return ret;
947 }
948
949 prelude_string_set_nodup(str, ptr);
950 }
951
952 ptr = get_value(msg, _("host"), NULL);
953 if ( ptr ) {
954 if ( ip && strcmp(ptr, ip) == 0 )
955 free(ptr);
956 else {
957 if ( ! source ) {
958 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
959 if ( ret < 0 ) {
960 free(ptr);
961 return ret;
962 }
963 }
964
965 ret = idmef_source_new_node(source, &node);
966 if ( ret < 0 ) {
967 free(ptr);
968 return ret;
969 }
970
971 ret = idmef_node_new_name(node, &str);
972 if ( ret < 0 ) {
973 free(ptr);
974 return ret;
975 }
976
977 prelude_string_set_nodup(str, ptr);
978 }
979 }
980
981 ptr = get_value(msg, _("name"), NULL);
982 if ( ptr ) {
983 ret = idmef_target_new_user(target, &user);
984 if ( ret < 0 ) {
985 free(ptr);
986 return ret;
987 }
988
989 idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
990
991 ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
992 if ( ret < 0 ) {
993 free(ptr);
994 return ret;
995 }
996
997 idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
998
999#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1000 sh_getpwnam_r(ptr, &pwd, buffer, sizeof(buffer), &pw);
1001#else
1002 pw = sh_getpwnam(ptr);
1003#endif
1004 if ( pw )
1005 idmef_user_id_set_number(user_id, pw->pw_uid);
1006
1007 ret = idmef_user_id_new_name(user_id, &str);
1008 if ( ret < 0 ) {
1009 free(ptr);
1010 return ret;
1011 }
1012 prelude_string_set_nodup(str, ptr);
1013
1014 ptr = get_value(msg, _("tty"), NULL);
1015 if ( ptr ) {
1016 ret = idmef_user_id_new_tty(user_id, &str);
1017 if ( ret < 0 ) {
1018 free(ptr);
1019 return ret;
1020 }
1021
1022 prelude_string_set_nodup(str, ptr);
1023 }
1024 }
1025
1026 ptr = get_time_value(msg, _("time"), NULL);
1027 if ( ptr ) {
1028 idmef_time_t *time;
1029
1030 ret = idmef_time_from_samhain(&time, ptr);
1031 free(ptr);
1032
1033 if ( ret < 0 )
1034 return ret;
1035
1036 idmef_alert_set_detect_time(alert, time);
1037 }
1038
1039 return 0;
1040}
1041
1042
1043static int samhain_alert_prelude(int priority, int sh_class,
1044 char *message, unsigned long msgid)
1045{
1046 int ret;
1047 idmef_time_t *time;
1048 idmef_alert_t *alert;
1049 idmef_message_t *idmef;
1050 idmef_classification_t *classification;
1051 idmef_assessment_t *assessment;
1052 idmef_additional_data_t *data;
1053 idmef_impact_t *impact;
1054 idmef_target_t *target;
1055 idmef_confidence_t *confidence;
1056 prelude_string_t *str;
1057
1058 if ( !client || sh_class == STAMP)
1059 return 0;
1060
1061 ret = idmef_message_new(&idmef);
1062 if ( ret < 0 )
1063 goto err;
1064
1065 ret = idmef_message_new_alert(idmef, &alert);
1066 if ( ret < 0 )
1067 goto err;
1068
1069 idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
1070
1071 ret = idmef_time_new_from_gettimeofday(&time);
1072 if ( ret < 0 )
1073 goto err;
1074 idmef_alert_set_detect_time(alert, time);
1075
1076 ret = idmef_time_new_from_gettimeofday(&time);
1077 if ( ret < 0 )
1078 goto err;
1079 idmef_alert_set_create_time(alert, time);
1080
1081 ret = idmef_alert_new_classification(alert, &classification);
1082 if ( ret < 0 )
1083 goto err;
1084
1085 ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
1086 if ( ret < 0 )
1087 goto err;
1088
1089 idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
1090
1091 if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
1092 idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
1093 idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
1094 }
1095
1096 if ( strstr(message, _("path=")) ) {
1097#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
1098 if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
1099 get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
1100#endif
1101
1102 get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
1103 }
1104
1105 ret = idmef_alert_new_assessment(alert, &assessment);
1106 if ( ret < 0 )
1107 goto err;
1108
1109 ret = idmef_assessment_new_impact(assessment, &impact);
1110 if ( ret < 0 )
1111 goto err;
1112
1113 ret = idmef_classification_new_text(classification, &str);
1114 if ( ret < 0 )
1115 goto err;
1116
1117 ret = get_login_info(message, alert);
1118 if ( ret < 0 )
1119 goto err;
1120
1121#ifdef SH_USE_PORTCHECK
1122 if (msgid == MSG_PORT_MISS || msgid == MSG_PORT_NEW || msgid == MSG_PORT_RESTART || msgid == MSG_PORT_NEWPORT) {
1123 ret = get_service_info(message, alert);
1124 if ( ret < 0 )
1125 goto err;
1126 }
1127#endif
1128
1129 map_policy_to_class(message, msgid, impact, str);
1130
1131#if 0
1132 if ( priority == SH_ERR_SEVERE || priority == SH_ERR_FATAL )
1133 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_HIGH);
1134
1135 else if ( priority == SH_ERR_ALL || priority == SH_ERR_INFO || priority == SH_ERR_NOTICE )
1136 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_LOW);
1137
1138 else
1139 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_MEDIUM);
1140#endif
1141 idmef_impact_set_severity(impact, map_severity(priority));
1142
1143 idmef_impact_set_completion(impact, IDMEF_IMPACT_COMPLETION_SUCCEEDED);
1144
1145 ret = idmef_assessment_new_confidence(assessment, &confidence);
1146 if ( ret < 0 )
1147 goto err;
1148
1149 idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
1150
1151 ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
1152 if ( ret < 0 )
1153 goto err;
1154
1155 ret = idmef_additional_data_new_meaning(data, &str);
1156 if ( ret < 0 )
1157 goto err;
1158
1159 prelude_string_set_dup(str, _("Message generated by Samhain"));
1160 idmef_additional_data_set_type(data, IDMEF_ADDITIONAL_DATA_TYPE_STRING);
1161 idmef_additional_data_set_string_ref(data, message);
1162
1163 /* debug_print_message(idmef); */
1164
1165 prelude_client_send_idmef(client, idmef);
1166 idmef_message_destroy(idmef);
1167
1168 return 0;
1169
1170 err:
1171 idmef_message_destroy(idmef);
1172 return -1;
1173}
1174
1175
1176int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
1177{
1178 int ret;
1179
1180 (void) msgflags; /* fix compiler warning */
1181
1182 if ( initialized < 1 )
1183 return -1;
1184
1185 ret = samhain_alert_prelude(priority, sh_class, message, msgid);
1186 if ( ret < 0 ) {
1187 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1188 _("Problem with IDMEF for prelude-ids support: alert lost"),
1189 _("sh_prelude_alert"));
1190 }
1191
1192 return ret;
1193}
1194
1195
1196
1197int sh_prelude_set_profile(const char *arg)
1198{
1199 if ( profile ) {
1200 free(profile);
1201 profile = NULL;
1202 }
1203
1204 if ( arg ) {
1205 profile = strdup(arg);
1206 if ( ! profile )
1207 return -1;
1208 }
1209
1210 return 0;
1211}
1212
1213/* Allow initialization of prelude; to be called
1214 * after forking the daemon. Delays heartbeat
1215 * start after config read until it is safe.
1216 */
1217void sh_prelude_reset(void)
1218{
1219 extern void sh_error_init_prelude();
1220
1221 ready_for_init = 1;
1222 sh_error_init_prelude();
1223 return;
1224}
1225
1226
1227
1228void sh_prelude_stop(void)
1229{
1230 if (initialized < 1)
1231 return;
1232
1233 if (sh.flag.isdaemon == S_TRUE)
1234 prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_FAILURE);
1235 else
1236 prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
1237
1238 client = NULL;
1239
1240 prelude_deinit();
1241
1242 initialized = 0;
1243 return;
1244}
1245
1246
1247
1248int sh_prelude_init(void)
1249{
1250 int ret;
1251 prelude_string_t *str;
1252 idmef_analyzer_t *analyzer;
1253 prelude_client_flags_t flags;
1254#ifdef SH_NOFAILOVER
1255 prelude_connection_pool_t *pool;
1256 prelude_connection_pool_flags_t conn_flags;
1257#endif
1258
1259 if (ready_for_init == 0)
1260 return initialized;
1261
1262 if (initialized > 0)
1263 return initialized;
1264
1265 prelude_thread_init(NULL);
1266 prelude_init(&sh_argc_store, sh_argv_store);
1267
1268 ret = prelude_client_new(&client, profile ? profile : _("samhain"));
1269 if ( ret < 0 ) {
1270 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1271 _("Failed to initialize Prelude"), _("sh_prelude_init"));
1272 initialized = -1;
1273 return -1;
1274 }
1275
1276 /*
1277 * Enable automatic heartbeat sending.
1278 */
1279 flags = prelude_client_get_flags(client);
1280 ret = prelude_client_set_flags(client, flags | PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
1281
1282 analyzer = prelude_client_get_analyzer(client);
1283
1284 ret = idmef_analyzer_new_model(analyzer, &str);
1285 prelude_string_set_dup(str, IDMEF_ANALYZER_MODEL);
1286
1287 ret = idmef_analyzer_new_class(analyzer, &str);
1288 prelude_string_set_dup(str, IDMEF_ANALYZER_CLASS);
1289
1290 ret = idmef_analyzer_new_version(analyzer, &str);
1291 prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
1292
1293#ifdef SH_NOFAILOVER
1294 pool = prelude_client_get_connection_pool(client);
1295 conn_flags = prelude_connection_pool_get_flags(pool);
1296
1297 conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
1298 prelude_connection_pool_set_flags(pool, conn_flags);
1299#endif
1300
1301 ret = prelude_client_start(client);
1302 if ( ret < 0 ) {
1303 prelude_perror(ret, _("error starting prelude client"));
1304
1305 if ( prelude_client_is_setup_needed(ret) )
1306 prelude_client_print_setup_error(client);
1307
1308 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1309 _("Failed to start Prelude"), _("sh_prelude_init"));
1310 initialized = -1;
1311 return -1;
1312 }
1313
1314 initialized = 1;
1315 return 1;
1316}
1317
1318/* HAVE_LIBPRELUDE_9 */
1319#endif
1320
Note: See TracBrowser for help on using the repository browser.